SSL on my site

Hi maybe someone did it or know how to make it work i just porches my SSL from my hosting company and its on my domain name but now that's where I have the problem its doesn't show the lock icon on my domain name (URL) www.thevortex.co and they say its something to do with the software does anyone know how I can have my entire site with the SSL icon so please know my site its 100% secure ? I'm running 7.1.2

thank you

  Danny 

There are some forum topics on this, use one of the off-site search engines to search Boonex.com.

Now, why do you want to pass every part of your site through ssl?  You do realise that encrypting the pages does slow them down a bit.  The only parts I would see is maybe the shops if you are passing credit card info.  Does your photo pages need to be encrypted?  Your blog posts?  Think about this for a moment and see if you really need to do so.

just get it to work thanks to ProfessorSr

it toke me not even 2 min to fix it was that easy so if anyone have that problem try this and hope that would work for u as well

First - once your ssl is activated and setup, the only way a user is accessing your site through the ssl is if the url is https://your-domain.com

the original http://your-domain.com will still function but it is not ssl encrypted

in your header.inc.php file you would have to change your site address from http:// to https://

in addition, if you want everyone to only use the ssl access to your site, then you would need to add a redirect in your htaccess file

 Danny

inc/header.inc.php is not the only place you will need to make changes. Search the forums, there are more.

You need to check each and every page on your site. There are some areas that will not work until more changes are made.


I agree with GG. I do not understand everyone sudden obsession with SSL. Unless you are storing peoples credit card information on your site and doing your own credit card processing on site then i do not see the need for the extra overhead encrypting packets puts on the site.

I went down that road... Purchased my Dolphin hosting package together with an SSL Certificate.

I had my entire site running on HTTPS for a while, then I changed it to work only for Join and profile edit (improved my page loading times considerably).

When it's time to renew my SSL registration, I'm not sure I'm going to do that.

I think nobody is obsessed with SSL because it makes really lots trouble until it works 100% with dolphin. The most annoying ones have to do with the flash apps and rms, or even with youtubes ssl support (yet no solution from google).

Why I had to go the SSL way is because in europe we have strict rules, even if you not store credit card information (btw to store them you need to be PCI certified here). So if you want to allow users to pay with credit cards for example the shopping card has to be SSL encrypted, sounds silly but it is. We went through a 2 month long process until we got the okay from the financial institutes and had to show them even the SSL descriptor, give them permission to test our system etc. for this we can offer every credit card and nearly every online payment provider you can find. (except Bitcoins....)

Nobody wants SSL, but after a given point in time, when you want to start business, your are being forced to use SSL. I not started to talk about european data protection directives which forces you to transmit personal data (like the profile/account infos) via SSL too.

Anybody know why the flash apps not work anymore when /flash/XML.php is being rewritten by the server to HTTPS? Is it hardcoded into the flash apps? Its the only file i was not able to move to SSL.

@gg: forget to move only the shopping card or single pages to SSL. I tried it for weeks but you run from one problem to the next. The solutions here to rewrite the site-url variable do not work well.

So what is needed is to figure out how to use SSL for those portions of the site that need to be encrypted and leave the rest alone.  There is no need to send a video through encryption and I am sure the law does not mandate so.

I have seen several reasons why a user would want their whole site SSL. In my case, I am dealing with medical info, so the HIPAA compliancy is extremely important. I am only using a few mods, and although the video mod is one of them - and this is in reference to the comment about not having the videos SSL, but I have other blocks on the page which the user can input data and answer questions, and it does need the SSL - so it was just best to SSL the whole site.

Second - and I hope someone can clarify this. I have seen several posts in which the person was told that they would have to go through the whole site and change all http references to https. I was told a long time ago that as long as you mod_rewrite from http to https in your .htaccess file, then you do not have to search through your entire site to change anything. The htaccess would do it for you as the page is called. In my usage, I have never had to change anything except the htaccess and all worked perfect.

I was told that using the htaccess to change the http to https can cause the site to slow down, and that it is better to use the v_host file to do the redirect. I have never used a v_host file so can not verify if this will work.

If someone could clarify this it would be greatly appreciated and helpful to many I think.

@geekgirl: There is no real solution for bringing just single pages to SSL, sooner or later you run into big problems even with javascript. I tried many times and every time i thought okay now it is working another problem arised. I worried too about server load but my tests showed the overhead is really low. The only difference is the initial handshake which takes a little bit longer. After it there is nearly no difference, and i tested it under heavy load on my server. Okay you should have a fast machine....

@Professor: Just change your site url to https in inc/header.inc.php and then the few hardcoded http to https, there will be no more rewrites because you are on https already. You only need a redirect if someone calls your site with http://
I also read about moving from .htaccess to the config file but forgot it totally. Now its on my todo list again, thanks for reminding me :)

@dately - please let me know how that goes. I wold like to try it myself once I know how to do it and exactly how it works.

I'm using the solution published in this topic, specifically in that post:

http://www.boonex.com/forums/topic/SSL-on-Dolphin-7-0-2.htm#98835

(The title says "Dolphin 7.0.2", but it works well on 7.1.X)

Note that in the profile edit page you get SSL warnings that not all content is secured. This is due to the fact that the footer links are HTTP and not HTTPS. I didn't bother to change it, but some ppl create a whole new custom footer for the profile edit page to remove these warnings.

Few reason i get the SSL on my site one of them its from people try to hack to the site and get people info

i`m not using it to sale anything so there is no Credit card that i have to worry about i just want it to be more secure and u can see a lot of big social media using SSL now like Facebook

 SSL won't prevent people from hacking your site. It also won't protect the data once it's saved in the database. SSL only protects data while it's being transmitted. It's meant to stop "eavesdropping" attacks, like packet sniffers and what not.

Exactly. mscott nailed it.

So thats why unless your transmitting sensitive data, there is no point in using it. It does not protect your site.

Facebook uses it now mostly because of the facebook payments system that is now in place for the facebook api and all of the games that deal with payments via that payment system.